@takodotid/circuit 0.19.0 → 0.20.0

package/dist/cli/index.js

@@ -1,4 +1,17 @@
 #!/usr/bin/env node
+import {
+  LAYERS,
+  addressesOf,
+  deviceId,
+  freeOfLength,
+  graphOf,
+  holdersOf,
+  keyOf,
+  only,
+  portsOf,
+  spell,
+  studioData
+} from "../chunks/index-jtzfw679.js";
 import {
   contains,
   familyOf,
@@ -8,10 +21,9 @@ import {
   isGlobal,
   netmask,
   network,
-  parse,
   split,
   wildcard
-} from "../chunks/index-dczpxzzm.js";
+} from "../chunks/index-xm9nma2t.js";
 import {
   __require,
   __toESM
@@ -19,8 +31,8 @@ import {
 
 // src/cli/index.ts
 import { createPrivateKey, createPublicKey } from "node:crypto";
-import { existsSync as existsSync2, mkdirSync, readdirSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "node:fs";
-import { basename, dirname, join as join2, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync3, mkdirSync, readdirSync as readdirSync2, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { basename as basename2, dirname as dirname2, join as join4, relative as relative2, resolve as resolve3, sep } from "node:path";
 
 // src/core/secrets.ts
 import { spawnSync } from "node:child_process";
@@ -208,44 +220,6 @@ function upload(client, path, content) {
   });
 }
 
-// src/adapters/devices/raisecom-ros/models.ts
-var models = {
-  "RAX721-C-6C48": {
-    ports: { "100g": 6, "25g": 24, "10g": 24 },
-    spelling: { "100g": "hundredgige 1/1/{n}", "25g": "twenty-fivegige 1/2/{n}", "10g": "tengigabitethernet 1/3/{n}" }
-  }
-};
-
-// src/adapters/devices/routeros/models.ts
-var models2 = {
-  "CCR2216-1G-12XS-2XQ": {
-    ports: { "100g": 2, "25g": 12, "1g": 1 },
-    spelling: { "100g": "qsfp28-{n}-1", "25g": "sfp28-{n}", "1g": "ether{n}" }
-  }
-};
-
-// src/adapters/devices/vrp/models.ts
-var models3 = {
-  "CE6855-48S6Q-HI": { ports: { "10g": 48, "40g": 6 }, spelling: { "10g": "10GE1/0/{n}", "40g": "40GE1/0/{n}" } }
-};
-
-// src/adapters/devices/catalog.ts
-var catalog = { routeros: models2, vrp: models3, "raisecom-ros": models };
-function portsOf(platform, model) {
-  const spec = catalog[platform]?.[model];
-  if (!spec)
-    throw new Error(`${platform} has no model ${model}`);
-  return Object.entries(spec.ports).flatMap(([speed, count]) => Array.from({ length: count }, (_, i) => `${speed}-${i + 1}`));
-}
-function spell(platform, model, port) {
-  const spec = catalog[platform]?.[model];
-  const parts = /^(\d+[gm])-(\d+)$/.exec(port);
-  const template = parts && spec?.spelling[parts[1]];
-  if (!template)
-    throw new Error(`${model} has no port ${port}`);
-  return template.replace("{n}", parts[2]);
-}
-
 // src/adapters/devices/derive.ts
 function lagIds(device) {
   const numbers = new Map;
@@ -263,6 +237,36 @@ function ipv4Networks(device, iface) {
   const addresses = (settings?.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
   return addresses.filter((address) => familyOf(address) === "ipv4").map((address) => network(address));
 }
+var SWITCH_SERVICES = ["ssh", "telnet", "snmp"];
+function switchUnsupported(device) {
+  const found = [];
+  for (const service of SWITCH_SERVICES) {
+    const settings = device.management?.[service];
+    if (settings?.allow)
+      found.push(`management.${service}.allow, every service takes management.allow`);
+    if (settings?.port)
+      found.push(`management.${service}.port`);
+  }
+  for (const [name, user] of Object.entries(device.users ?? {})) {
+    if (user.description)
+      found.push(`users.${name}.description`);
+    if (user.ssh_keys?.length)
+      found.push(`users.${name}.ssh_keys`);
+  }
+  if (device.system?.ip)
+    found.push("system.ip");
+  for (const [name, port] of Object.entries(device.ports ?? {})) {
+    if (port?.hardware_offload !== undefined)
+      found.push(`ports.${name}.hardware_offload`);
+  }
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.addresses?.some((entry) => typeof entry !== "string"))
+      found.push(`interfaces.${name}.addresses with a peer`);
+    if (iface.hardware_offload !== undefined)
+      found.push(`interfaces.${name}.hardware_offload`);
+  }
+  return found;
+}
 
 // src/adapters/devices/lines.ts
 var indentOf = (raw) => raw.length - raw.trimStart().length;
@@ -308,12 +312,12 @@ function head(line) {
 }
 function compare(desired, current, dialect) {
   const canon = dialect.canon ?? ((line) => line);
-  const keyOf = (entry) => [...entry.path, canon(entry.line)].join("\x00");
+  const keyOf2 = (entry) => [...entry.path, canon(entry.line)].join("\x00");
   const pathKey = (path) => path.join("\x00");
   const wanted = entries(desired, dialect);
   const existing = entries(current, dialect);
-  const wantedKeys = new Set(wanted.map(keyOf));
-  const existingKeys = new Set(existing.map(keyOf));
+  const wantedKeys = new Set(wanted.map(keyOf2));
+  const existingKeys = new Set(existing.map(keyOf2));
   const wantedBlocks = new Set(wanted.map((entry) => pathKey([...entry.path, entry.line])));
   const groups = new Map;
   const groupFor = (path) => {
@@ -323,7 +327,7 @@ function compare(desired, current, dialect) {
     return groups.get(key);
   };
   for (const entry of wanted) {
-    if (existingKeys.has(keyOf(entry)))
+    if (existingKeys.has(keyOf2(entry)))
       continue;
     const ownBlock = pathKey([...entry.path, entry.line]);
     const opensBlock = wanted.some((other) => {
@@ -335,7 +339,7 @@ function compare(desired, current, dialect) {
     groupFor(entry.path).add.push(entry.line);
   }
   for (const entry of [...existing].reverse()) {
-    if (wantedKeys.has(keyOf(entry)))
+    if (wantedKeys.has(keyOf2(entry)))
       continue;
     const insideRemovedBlock = entry.path.some((_, depth) => {
       const enclosing = pathKey(entry.path.slice(0, depth + 1));
@@ -345,7 +349,7 @@ function compare(desired, current, dialect) {
       continue;
     const replaced = wanted.some((other) => {
       const sameBlock = pathKey(other.path) === pathKey(entry.path);
-      const isNew = !existingKeys.has(keyOf(other));
+      const isNew = !existingKeys.has(keyOf2(other));
       return sameBlock && isNew && head(other.line) === head(entry.line);
     });
     if (!replaced)
@@ -353,7 +357,7 @@ function compare(desired, current, dialect) {
   }
   return [...groups.values()].filter((group) => group.add.length || group.remove.length);
 }
-function vlanListChange(groups, prefix, parse2, format, removal) {
+function vlanListChange(groups, prefix, parse, format, removal) {
   const top = groups.find((group) => group.path.length === 0);
   if (!top)
     return;
@@ -361,8 +365,8 @@ function vlanListChange(groups, prefix, parse2, format, removal) {
   const fresh = top.add.find((line) => line.startsWith(prefix));
   if (!old && !fresh)
     return;
-  const before = old ? parse2(old) : [];
-  const after = fresh ? parse2(fresh) : [];
+  const before = old ? parse(old) : [];
+  const after = fresh ? parse(fresh) : [];
   top.remove = top.remove.filter((line) => line !== old);
   top.add = top.add.filter((line) => line !== fresh);
   const added = after.filter((id) => !before.includes(id));
@@ -716,8 +720,15 @@ function unsupported(device) {
       found.push(`interfaces.${name}, a ${iface.type}`);
       continue;
     }
-    if (iface.vrf)
-      found.push(`interfaces.${name}.vrf`);
+    for (const field of ["vrf", "description", "mtu", "ipv6_ra"]) {
+      if (iface[field] !== undefined)
+        found.push(`interfaces.${name}.${field}`);
+    }
+    for (const entry of iface.addresses ?? []) {
+      const address = typeof entry === "string" ? entry : entry.address;
+      if (familyOf(address) === "ipv6")
+        found.push(`interfaces.${name}.addresses ${address}, only IPv4 here`);
+    }
     for (const group of iface.vrrp ?? []) {
       if (familyOf(group.address) === "ipv6")
         found.push(`interfaces.${name}.vrrp for IPv6`);
@@ -740,8 +751,15 @@ function unsupported(device) {
     }
   }
   for (const route of routing?.static ?? []) {
-    if (!route.via || route.vrf)
+    if (!route.via || route.vrf || familyOf(route.prefix) === "ipv6") {
       found.push(`routing.static ${route.prefix}, only an IPv4 next hop in the default table`);
+    }
+    if (route.description || route.distance)
+      found.push(`routing.static ${route.prefix} description and distance`);
+  }
+  for (const [name, vlan] of Object.entries(device.vlans ?? {})) {
+    if (vlan.description)
+      found.push(`vlans.${name}.description`);
   }
   const UNSUPPORTED_SECTIONS = [
     "firewall",
@@ -768,6 +786,10 @@ function unsupported(device) {
     if (!SNMP_AUTH[user.auth])
       found.push(`management.snmp.users.${name}.auth ${user.auth}, the platform authenticates with SHA1 or MD5`);
   }
+  if (management.snmp?.contact || management.snmp?.location)
+    found.push("management.snmp.contact and location");
+  if (management.ssh?.weak_crypto)
+    found.push("management.ssh.weak_crypto");
   if (device.lldp && device.lldp !== true)
     found.push("lldp.interfaces, LLDP is per device");
   if (device.stp?.mode && device.stp.mode !== "mstp")
@@ -780,6 +802,7 @@ function unsupported(device) {
   if (system.dns || system.logging || system.release_channel || system.banner || system.ntp?.serve) {
     found.push("system.dns, logging, release_channel, banner and ntp.serve");
   }
+  found.push(...switchUnsupported(device));
   return found;
 }
 var REFUSED = /^(%|Error|Incomplete|Unrecognized)|can not|cannot |is in use|Wrong parameter|invalid|unsuccessful/im;
@@ -961,7 +984,7 @@ function parseLine(menu, line) {
   }
   return { menu, verb, selector, flags, attrs };
 }
-function parse2(text) {
+function parse(text) {
   const commands = [];
   const generated = new Set;
   let menu = "";
@@ -1414,8 +1437,8 @@ function planOrdered(menu, wanted, existing) {
   return result;
 }
 function plan2(desired, current, options) {
-  const want = parse2(desired);
-  const have = parse2(current);
+  const want = parse(desired);
+  const have = parse(current);
   const owned = (command) => !(command.menu.endsWith("address-list") && want.generated.has(command.attrs.list ?? ""));
   const wantedByMenu = byMenu(want.commands.filter(owned));
   const existingByMenu = byMenu(have.commands.filter(owned));
@@ -2588,6 +2611,14 @@ function unsupported2(device) {
       found.push(`ports.${name}.storm_control with a different percent per kind, the platform takes one`);
     }
   }
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type !== "lag")
+      continue;
+    for (const field of ["storm_control", "stp"]) {
+      if (iface[field] !== undefined)
+        found.push(`interfaces.${name}.${field}, on a LAG`);
+    }
+  }
   const bgp = device.routing?.bgp;
   for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
     const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
@@ -2600,6 +2631,8 @@ function unsupported2(device) {
     found.push("management.console, the console uses the device's users");
   if (management?.privilege_password)
     found.push("management.privilege_password, the platform has no privileged mode");
+  if (management?.snmp?.port)
+    found.push("management.snmp.port");
   if (management?.ssh?.auth_timeout || management?.ssh?.auth_retries) {
     found.push("management.ssh.auth_timeout and auth_retries");
   }
@@ -3225,10 +3258,16 @@ function unsupported3(device) {
       found.push(`interfaces.${name}, a ${iface.type}`);
     if (iface.type === "lag" && iface.addresses?.length)
       found.push(`interfaces.${name}.addresses, LAGs are switched`);
+    if (iface.mtu !== undefined)
+      found.push(`interfaces.${name}.mtu`);
     for (const group of iface.vrrp ?? [])
       if (familyOf(group.address) === "ipv6")
         found.push(`interfaces.${name}.vrrp for IPv6`);
   }
+  for (const [name, vrf] of Object.entries(device.vrfs ?? {})) {
+    if (vrf.description)
+      found.push(`vrfs.${name}.description`);
+  }
   const routing = device.routing;
   if (routing?.bgp)
     found.push("routing.bgp");
@@ -3259,6 +3298,9 @@ function unsupported3(device) {
   if (system2.dns || system2.logging || system2.release_channel || system2.banner) {
     found.push("system.dns, logging, release_channel and banner");
   }
+  if (system2.transceiver_monitoring !== undefined)
+    found.push("system.transceiver_monitoring");
+  found.push(...switchUnsupported(device));
   const flow = device.flow_export;
   if (flow && flow.protocol !== "sflow")
     found.push(`flow_export.protocol ${flow.protocol}, the platform exports sFlow`);
@@ -3438,10 +3480,10 @@ async function sendLibreNms(network2, additions) {
 
 // src/adapters/registries/peeringdb.ts
 var API = "https://www.peeringdb.com/api";
-var addressesOf = (iface) => (iface.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
+var addressesOf2 = (iface) => (iface.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
 function peersWithRouteServer(device, iface) {
   const bgp = device.routing?.bgp;
-  const subnets = addressesOf(iface);
+  const subnets = addressesOf2(iface);
   return Object.values(bgp?.neighbors ?? {}).some((neighbor) => {
     const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
     const role = neighbor.role ?? group?.role;
@@ -3455,7 +3497,7 @@ function wanted(network2) {
       const exchange = iface.exchange;
       if (!exchange?.peeringdb_ixlan)
         continue;
-      const published = addressesOf(iface).map(host).filter(isGlobal);
+      const published = addressesOf2(iface).map(host).filter(isGlobal);
       records.push({
         name: exchange.name,
         ixlan_id: exchange.peeringdb_ixlan,
@@ -3571,419 +3613,245 @@ function snmpExporterAuths(network2) {
 `, notes };
 }
 
-// src/core/graph.ts
-var LAYERS = ["l1", "l2", "l3", "bgp", "ospf", "tunnels"];
-var deviceId = (name) => `device:${name}`;
-function keyOf(address) {
-  if (!address || !isAddress(address))
-    return;
-  return `${familyOf(address)}:${parse(address)}`;
-}
-var isHostRoute = (cidr) => {
-  const { len, family } = split(cidr);
-  return len === (family === "ipv4" ? 32 : 128);
-};
+// src/core/validate.ts
+import { X509Certificate as X509Certificate2 } from "node:crypto";
 
-class Builder {
-  nodes = new Map;
-  edges = [];
-  node(id, kind, label, detail = []) {
-    const existing = this.nodes.get(id);
-    if (!existing)
-      this.nodes.set(id, { id, kind, label, detail: [...detail] });
-    else
-      for (const line2 of detail)
-        if (!existing.detail.includes(line2))
-          existing.detail.push(line2);
-    return id;
-  }
-  edge(edge) {
-    this.edges.push(edge);
-    return edge;
+// src/core/across.ts
+function checkAcross(devices) {
+  const holders2 = holdersOf(devices);
+  const owners = new Map;
+  for (const holder of holders2) {
+    const key = keyOf(host(holder.address));
+    if (!owners.has(key))
+      owners.set(key, holder);
   }
+  return [
+    ...checkLinks(devices),
+    ...checkAddresses(holders2),
+    ...checkSessions(devices, owners),
+    ...checkVrrp(holders2),
+    ...checkTunnels(devices, owners)
+  ];
 }
-function routedOf(device) {
-  const ports = Object.entries(device.ports ?? {}).flatMap(([name, port]) => port ? [[name, port]] : []);
-  const interfaces = Object.entries(device.interfaces ?? {});
-  return [...ports, ...interfaces];
+function carried(device, port) {
+  const id = (vlan) => vlan ? device.vlans?.[vlan]?.id : undefined;
+  return {
+    access: id(port.access_vlan),
+    native: id(port.native_vlan),
+    trunk: (port.trunk_vlans ?? []).map(id).sort((a, b) => (a ?? 0) - (b ?? 0))
+  };
 }
-function holdersOf(devices) {
-  return devices.flatMap((device) => routedOf(device).flatMap(([name, settings]) => (settings.addresses ?? []).flatMap((entry) => {
-    const address = typeof entry === "string" ? entry : entry.address;
-    if (!isCidr(address))
-      return [];
-    const peer = typeof entry === "string" ? undefined : entry.peer;
-    return [{ device, name, address, peer, vrrp: settings.vrrp ?? [] }];
-  })));
-}
-function describeDevice(device) {
-  const addresses2 = routedOf(device).filter(([, settings]) => settings.addresses?.length).map(([name, settings]) => {
-    const list = (settings.addresses ?? []).map((entry) => typeof entry === "string" ? entry : `${entry.address} to ${entry.peer}`);
-    const vrf = settings.vrf ? `, VRF ${settings.vrf}` : "";
-    return `${name}: ${list.join(", ")}${vrf}`;
-  });
-  return [`${device.platform} ${device.model}`, `reached at ${device.connection.host}`, ...addresses2];
+function vlanNames(device, settings) {
+  const names = [settings.access_vlan, settings.native_vlan, ...settings.trunk_vlans ?? []].filter((name) => name !== undefined);
+  return new Map(names.flatMap((name) => device.vlans?.[name] ? [[device.vlans[name].id, name]] : []));
 }
-function carriedBy(device, settings) {
-  const vlan = (name, untagged) => {
-    const id = name ? device.vlans?.[name]?.id : undefined;
-    return name && id !== undefined ? [{ name, id, untagged }] : [];
-  };
-  const trunk = (settings?.trunk_vlans ?? []).filter((name) => name !== settings?.native_vlan);
-  return [...vlan(settings?.access_vlan, true), ...vlan(settings?.native_vlan, true), ...trunk.flatMap((name) => vlan(name, false))].sort((a, b) => a.id - b.id);
+function carrierOf(device, portName, port) {
+  const lag = port.lag ? device.interfaces?.[port.lag] : undefined;
+  if (port.lag && lag?.type === "lag")
+    return { name: port.lag, settings: lag };
+  return { name: portName, settings: port };
 }
-function vlanLabel(vlans) {
-  if (vlans.length === 1)
-    return `${vlans[0].name}${vlans[0].untagged ? ", untagged" : ""}`;
-  if (vlans.length <= 3)
-    return vlans.map((vlan) => vlan.name).join(", ");
-  return `${vlans.length} VLANs`;
+var plainAddresses = (settings, family) => (settings.addresses ?? []).filter((entry) => typeof entry === "string" && isCidr(entry) && familyOf(entry) === family);
+function addressDisagreement(here, there, far, farName) {
+  for (const family of ["ipv4", "ipv6"]) {
+    const ours = plainAddresses(here, family);
+    const theirs = plainAddresses(there, family);
+    if (!ours.length || !theirs.length)
+      continue;
+    const theirPrefixes = new Set(theirs.map(network));
+    if (!ours.some((address) => theirPrefixes.has(network(address)))) {
+      return `has ${ours.join(", ")}, and ${far.name} ${farName} has ${theirs.join(", ")}: not one prefix of one length`;
+    }
+  }
+  const farHosts = new Set((there.addresses ?? []).map((entry) => keyOf(host(typeof entry === "string" ? entry : entry.address))));
+  for (const entry of here.addresses ?? []) {
+    if (typeof entry === "string" || !keyOf(entry.peer) || farHosts.has(keyOf(entry.peer)))
+      continue;
+    return `${entry.address} names peer ${entry.peer}, which ${far.name} ${farName} does not hold`;
+  }
+  return;
 }
-function cables(devices, graph) {
+function checkLinks(devices) {
+  const findings = [];
   const byName = new Map(devices.map((device) => [device.name, device]));
-  const drawn = new Set;
-  const bundles = new Map;
   for (const device of devices) {
     for (const [portName, port] of Object.entries(device.ports ?? {})) {
       const link = port?.link;
       if (!port || !link)
         continue;
-      const here = `${device.name} ${portName}`;
-      const there = `${link.device} ${link.port}`;
-      if (drawn.has(`${there}|${here}`))
-        continue;
-      drawn.add(`${here}|${there}`);
+      const report = (message, level = "error") => findings.push({
+        level,
+        device: device.name,
+        message: `port ${portName} link: ${message}`
+      });
       const far = byName.get(link.device);
-      const farPort = far?.ports?.[link.port];
-      const linksBack = farPort?.link?.device === device.name && farPort.link.port === portName;
-      const to = far ? deviceId(far.name) : graph.node(`missing:${link.device}`, "outside", link.device, ["named by a link, and not in the network"]);
-      const cableLine = `${here} to ${there}`;
-      const lag = port.lag;
-      const farLag = farPort?.lag;
-      const bundleKey = `${device.name} ${lag}|${link.device} ${farLag}`;
-      const bundle = lag && farLag && linksBack ? bundles.get(bundleKey) : undefined;
-      if (bundle) {
-        bundle.members++;
-        bundle.cable.detail.push(cableLine);
-        bundle.cable.label = `${lag} to ${farLag}, ${bundle.members} cables`;
+      if (!far) {
+        report(`device ${link.device} is not in the network`);
         continue;
       }
-      const isBundle = Boolean(lag && farLag && linksBack);
-      const cable = graph.edge({
-        layer: "l1",
-        from: deviceId(device.name),
-        to,
-        label: isBundle ? `${lag} to ${farLag}` : `${portName} to ${link.port}`,
-        detail: [cableLine],
-        ...linksBack ? {} : { oneSided: true }
-      });
-      if (isBundle)
-        bundles.set(bundleKey, { cable, members: 1 });
-      const lagSettings = lag ? device.interfaces?.[lag] : undefined;
-      const carrier = lagSettings?.type === "lag" ? lagSettings : lag ? undefined : port;
-      const vlans = carriedBy(device, carrier);
-      if (!vlans.length)
+      const farPort = far.ports?.[link.port];
+      if (!farPort) {
+        report(`${link.device} does not declare port ${link.port}`);
         continue;
-      graph.edge({
-        layer: "l2",
-        from: deviceId(device.name),
-        to,
-        label: vlanLabel(vlans),
-        detail: [
-          `${device.name} ${lag ?? portName}`,
-          ...vlans.map((vlan) => `${vlan.name}, VLAN ${vlan.id}${vlan.untagged ? ", untagged" : ""}`)
-        ],
-        vlans,
-        ...linksBack ? {} : { oneSided: true }
-      });
+      }
+      const linksBack = farPort.link?.device === device.name && farPort.link.port === portName;
+      if (!linksBack) {
+        report(`${link.device} ${link.port} does not link back to it`);
+        continue;
+      }
+      const here = JSON.stringify(carried(device, port));
+      const there = JSON.stringify(carried(far, farPort));
+      if (here !== there)
+        report(`carries ${here}, and ${link.device} ${link.port} carries ${there}`);
+      if (port.speed && farPort.speed && port.speed !== farPort.speed) {
+        report(`speed ${port.speed}, and ${link.device} ${link.port} is ${farPort.speed}`);
+      }
+      const near = carrierOf(device, portName, port);
+      const away = carrierOf(far, link.port, farPort);
+      const mtu = near.settings.mtu ?? 1500;
+      const farMtu = away.settings.mtu ?? 1500;
+      if (mtu !== farMtu)
+        report(`MTU ${mtu} on ${near.name}, and ${link.device} ${away.name} has ${farMtu}`);
+      const disagreement = addressDisagreement(near.settings, away.settings, far, away.name);
+      if (disagreement)
+        report(`${near.name} ${disagreement}`);
+      const farNames = vlanNames(far, away.settings);
+      for (const [id, name] of vlanNames(device, near.settings)) {
+        const farName = farNames.get(id);
+        if (farName && farName !== name)
+          report(`VLAN ${id} is ${name} here and ${farName} on ${link.device}`, "warning");
+      }
     }
   }
+  return findings;
 }
-function segments(holders2, owners, graph) {
-  const bySegment = new Map;
-  const pairs = new Set;
+function checkAddresses(holders2) {
+  const findings = [];
+  const first = new Map;
+  const isLoopback = (holder) => holder.device.interfaces?.[holder.name]?.type === "loopback";
   for (const holder of holders2) {
-    if (holder.peer) {
-      const far = owners.get(keyOf(holder.peer) ?? "");
-      if (!far || far.device === holder.device)
-        continue;
-      const ends = [`${holder.device.name} ${holder.name}`, `${far.device.name} ${far.name}`].sort().join("|");
-      if (pairs.has(ends))
-        continue;
-      pairs.add(ends);
-      graph.edge({
-        layer: "l3",
-        from: deviceId(holder.device.name),
-        to: deviceId(far.device.name),
-        label: `${host(holder.address)} to ${host(far.address)}`,
-        detail: [`${holder.device.name} ${holder.name} ${holder.address}`, `${far.device.name} ${far.name} ${far.address}`]
-      });
+    const key = keyOf(host(holder.address));
+    const earlier = first.get(key);
+    if (!earlier) {
+      first.set(key, holder);
       continue;
     }
-    if (isHostRoute(holder.address))
-      continue;
-    const segment = network(holder.address);
-    bySegment.set(segment, [...bySegment.get(segment) ?? [], holder]);
-  }
-  for (const [segment, members] of bySegment) {
-    if (new Set(members.map((member) => member.device.name)).size < 2)
-      continue;
-    const memberLines = members.map((member) => `${member.device.name} ${member.name} ${member.address}`);
-    const vrrpLines3 = members.flatMap((member) => member.vrrp.map((group) => `VRRP ${group.id} ${group.address} on ${member.device.name}, priority ${group.priority ?? 100}`));
-    if (members.length === 2) {
-      const [a, b] = members;
-      graph.edge({
-        layer: "l3",
-        from: deviceId(a.device.name),
-        to: deviceId(b.device.name),
-        label: segment,
-        detail: [...memberLines, ...vrrpLines3]
-      });
+    if (earlier.device === holder.device)
       continue;
-    }
-    const id = graph.node(`segment:${segment}`, "segment", segment, [...memberLines, ...vrrpLines3]);
-    for (const member of members) {
-      graph.edge({
-        layer: "l3",
-        from: deviceId(member.device.name),
-        to: id,
-        label: `${member.name} ${host(member.address)}`,
-        detail: [`${member.device.name} ${member.name} ${member.address}`]
-      });
-    }
+    const anycast = isLoopback(earlier) && isLoopback(holder);
+    findings.push({
+      level: anycast ? "warning" : "error",
+      device: holder.device.name,
+      message: `${host(holder.address)} on ${holder.name} is also on ${earlier.device.name} ${earlier.name}${anycast ? ", which is right only for anycast" : ""}`
+    });
   }
+  return findings;
 }
-function sessions(devices, owners, graph) {
-  const all = devices.flatMap((device) => {
+function checkSessions(devices, owners) {
+  const findings = [];
+  const sessionsOf = (device) => {
     const bgp = device.routing?.bgp;
     return Object.entries(bgp?.neighbors ?? {}).map(([name, neighbor]) => {
       const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
       return {
-        device,
         name,
         address: neighbor.address,
-        ownAs: bgp.asn,
         remoteAs: neighbor.remote_as ?? group?.remote_as,
-        role: neighbor.role ?? group?.role,
-        description: neighbor.description ?? group?.description,
-        import: neighbor.import ?? group?.import,
-        export: neighbor.export ?? group?.export
+        localAddress: neighbor.local_address ?? group?.local_address
       };
     });
-  });
-  const describe2 = (session) => {
-    const parts = [
-      session.address,
-      session.remoteAs ? `AS${session.remoteAs}` : "no remote AS",
-      session.role,
-      session.import ? `import ${session.import}` : "imports nothing",
-      session.export ? `export ${session.export}` : "exports nothing"
-    ];
-    return `${session.device.name} ${session.name}: ${parts.filter(Boolean).join(", ")}`;
   };
-  const ownerOf = (session) => owners.get(keyOf(session.address) ?? "")?.device;
-  const paired = new Set;
-  for (const session of all) {
-    if (paired.has(session))
-      continue;
-    const far = ownerOf(session);
-    if (far && far !== session.device) {
-      const back = all.find((other) => other.device === far && !paired.has(other) && ownerOf(other) === session.device);
-      if (back)
-        paired.add(back);
-      graph.edge({
-        layer: "bgp",
-        from: deviceId(session.device.name),
-        to: deviceId(far.name),
-        label: session.remoteAs === session.ownAs ? "iBGP" : "eBGP",
-        detail: [describe2(session), ...back ? [describe2(back)] : [`${far.name} has no session back`]],
-        ...back ? {} : { oneSided: true }
-      });
-      continue;
+  for (const device of devices) {
+    for (const session of sessionsOf(device)) {
+      const far = owners.get(keyOf(session.address) ?? "")?.device;
+      if (!far || far === device)
+        continue;
+      const report = (message) => findings.push({ level: "error", device: device.name, message: `neighbor ${session.name}: ${message}` });
+      const farBgp = far.routing?.bgp;
+      if (!farBgp) {
+        report(`${session.address} is ${far.name}'s, which runs no BGP`);
+        continue;
+      }
+      if (session.remoteAs !== undefined && session.remoteAs !== farBgp.asn) {
+        report(`expects AS${session.remoteAs}, and ${far.name} is AS${farBgp.asn}`);
+      }
+      const back = sessionsOf(far).find((other) => owners.get(keyOf(other.address) ?? "")?.device === device && familyOf(other.address) === familyOf(session.address));
+      if (!back) {
+        report(`${far.name} has no session back to ${device.name}`);
+        continue;
+      }
+      if (session.localAddress && keyOf(session.localAddress) !== keyOf(back.address)) {
+        report(`starts from ${session.localAddress}, and ${far.name}'s session ${back.name} expects ${back.address}`);
+      }
     }
-    const outside = session.remoteAs ? graph.node(`as:${session.remoteAs}`, "outside", `AS${session.remoteAs}`, session.description ? [session.description] : []) : graph.node(`address:${session.address}`, "outside", session.address, ["a BGP neighbor without a remote AS"]);
-    const internal = session.remoteAs === session.ownAs;
-    graph.edge({
-      layer: "bgp",
-      from: deviceId(session.device.name),
-      to: outside,
-      label: [session.name, session.role].filter(Boolean).join(", "),
-      detail: [describe2(session), ...internal ? ["internal, and no device in the network holds the address"] : []],
-      ...internal ? { oneSided: true } : {}
-    });
   }
+  return findings;
 }
-function adjacencies(devices, graph) {
-  const byKey = new Map;
-  for (const device of devices) {
-    for (const [area, { interfaces }] of Object.entries(device.routing?.ospf?.areas ?? {})) {
-      for (const [name, settings] of Object.entries(interfaces)) {
-        if (settings?.passive)
-          continue;
-        const routed = device.ports?.[name] ?? device.interfaces?.[name];
-        const cost = settings?.cost ? `, cost ${settings.cost}` : "";
-        for (const entry of routed?.addresses ?? []) {
-          const address = typeof entry === "string" ? entry : entry.address;
-          if (!isCidr(address) || isHostRoute(address))
-            continue;
-          const key = `${area} ${network(address)}`;
-          const member = { device, name, line: `${device.name} ${name} ${address}${cost}` };
-          byKey.set(key, [...byKey.get(key) ?? [], member]);
-        }
-      }
+function checkVrrp(holders2) {
+  const findings = [];
+  const bySegment = new Map;
+  for (const holder of holders2) {
+    const segment = network(holder.address);
+    for (const group of holder.vrrp) {
+      if (!keyOf(group.address) || familyOf(group.address) !== familyOf(holder.address))
+        continue;
+      if (!contains(segment, group.address))
+        continue;
+      bySegment.set(segment, [...bySegment.get(segment) ?? [], { holder, id: group.id, address: group.address }]);
     }
   }
-  for (const [key, members] of byKey) {
-    const [area] = key.split(" ");
-    for (const [index, a] of members.entries()) {
-      for (const b of members.slice(index + 1)) {
-        if (a.device === b.device)
-          continue;
-        graph.edge({
-          layer: "ospf",
-          from: deviceId(a.device.name),
-          to: deviceId(b.device.name),
-          label: `area ${area}`,
-          detail: [a.line, b.line]
+  for (const members of bySegment.values()) {
+    for (const member of members) {
+      const where = `${member.holder.device.name} ${member.holder.name}`;
+      const others = members.filter((other) => other.holder.device !== member.holder.device);
+      const sameId = others.find((other) => other.id === member.id && keyOf(other.address) !== keyOf(member.address));
+      if (sameId) {
+        findings.push({
+          level: "error",
+          device: member.holder.device.name,
+          message: `VRRP ${member.id} on ${member.holder.name} is ${member.address}, and on ${sameId.holder.device.name} ${sameId.holder.name} it is ${sameId.address}`
+        });
+      }
+      const sameAddress = others.find((other) => keyOf(other.address) === keyOf(member.address) && other.id !== member.id);
+      if (sameAddress) {
+        findings.push({
+          level: "error",
+          device: member.holder.device.name,
+          message: `VRRP address ${member.address} is id ${member.id} on ${where}, and id ${sameAddress.id} on ${sameAddress.holder.device.name} ${sameAddress.holder.name}`
         });
       }
     }
   }
+  return findings;
 }
-var endpointHost = (endpoint) => endpoint.replace(/:\d+$/, "").replace(/^\[(.*)\]$/, "$1");
-function tunnels2(devices, owners, graph) {
+function checkTunnels(devices, owners) {
+  const findings = [];
   const ends = devices.flatMap((device) => Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) => iface.type === "gre" || iface.type === "vxlan" ? [{ device, name, iface }] : []));
   const same = (a, b) => keyOf(a) !== undefined && keyOf(a) === keyOf(b);
-  const mirrors = (a, b) => a.device !== b.device && a.iface.type === b.iface.type && same(a.iface.local, b.iface.remote) && same(a.iface.remote, b.iface.local) && (a.iface.type !== "vxlan" || b.iface.type === "vxlan" && a.iface.vni === b.iface.vni);
-  const describe2 = (end) => {
-    const vni = end.iface.type === "vxlan" ? `, VNI ${end.iface.vni}` : "";
-    return `${end.device.name} ${end.name}: ${end.iface.local} to ${end.iface.remote}${vni}`;
-  };
-  const paired = new Set;
   for (const end of ends) {
-    if (paired.has(end))
+    const far = owners.get(keyOf(end.iface.remote) ?? "")?.device;
+    if (!far || far === end.device)
       continue;
+    const report = (message) => findings.push({ level: "error", device: end.device.name, message: `interface ${end.name}: ${message}` });
     const kind = end.iface.type === "gre" ? "GRE" : "VXLAN";
-    const mirror = ends.find((other) => !paired.has(other) && mirrors(end, other));
-    if (mirror) {
-      paired.add(mirror);
-      graph.edge({
-        layer: "tunnels",
-        from: deviceId(end.device.name),
-        to: deviceId(mirror.device.name),
-        label: `${kind} ${end.name} to ${mirror.name}`,
-        detail: [describe2(end), describe2(mirror)]
-      });
+    const mirror = ends.find((other) => other.device === far && other.iface.type === end.iface.type && same(other.iface.local, end.iface.remote) && same(other.iface.remote, end.iface.local));
+    if (!mirror) {
+      report(`${end.iface.remote} is ${far.name}'s, which has no ${kind} tunnel from there back to ${end.iface.local}`);
       continue;
     }
-    const owner = owners.get(keyOf(end.iface.remote) ?? "")?.device;
-    if (owner && owner !== end.device) {
-      graph.edge({
-        layer: "tunnels",
-        from: deviceId(end.device.name),
-        to: deviceId(owner.name),
-        label: `${kind} ${end.name}`,
-        detail: [describe2(end), `${owner.name} declares no tunnel back`],
-        oneSided: true
-      });
+    if (end.iface.type !== "vxlan" || mirror.iface.type !== "vxlan")
       continue;
-    }
-    const outside = graph.node(`address:${end.iface.remote}`, "outside", end.iface.remote, end.iface.description ? [end.iface.description] : []);
-    graph.edge({
-      layer: "tunnels",
-      from: deviceId(end.device.name),
-      to: outside,
-      label: `${kind} ${end.name}`,
-      detail: [describe2(end)]
-    });
-  }
-  wireguard2(devices, owners, graph);
-}
-function wireguard2(devices, owners, graph) {
-  const interfaces = devices.flatMap((device) => Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) => iface.type === "wireguard" ? [{ device, name, iface }] : []));
-  const farEndOf = (device, peer) => interfaces.find(({ device: other, iface }) => {
-    if (other === device)
-      return false;
-    const tunnelAddresses = (iface.addresses ?? []).map((entry) => host(typeof entry === "string" ? entry : entry.address));
-    const sendsFrom = tunnelAddresses.some((address) => isAddress(address) && peer.allowed_addresses.some((allowed) => isCidr(allowed) && contains(allowed, address)));
-    const endpoint = peer.endpoint ? endpointHost(peer.endpoint) : undefined;
-    const isEndpoint = endpoint !== undefined && owners.get(keyOf(endpoint) ?? "")?.device === other;
-    return sendsFrom || isEndpoint;
-  });
-  const drawn = new Set;
-  for (const { device, name, iface } of interfaces) {
-    const clients = [];
-    for (const peer of iface.peers ?? []) {
-      const far = farEndOf(device, peer);
-      if (far) {
-        const ends = [`${device.name} ${name}`, `${far.device.name} ${far.name}`].sort().join("|");
-        if (drawn.has(ends))
-          continue;
-        drawn.add(ends);
-        graph.edge({
-          layer: "tunnels",
-          from: deviceId(device.name),
-          to: deviceId(far.device.name),
-          label: `WireGuard ${name} to ${far.name}`,
-          detail: [`${device.name} ${name} peer ${peer.name}`]
-        });
-        continue;
-      }
-      if (!peer.endpoint) {
-        clients.push(peer);
-        continue;
-      }
-      const endpoint = endpointHost(peer.endpoint);
-      const outside2 = graph.node(`address:${endpoint}`, "outside", peer.name, [`WireGuard endpoint ${peer.endpoint}`]);
-      graph.edge({
-        layer: "tunnels",
-        from: deviceId(device.name),
-        to: outside2,
-        label: `WireGuard ${name}`,
-        detail: [`${device.name} ${name} peer ${peer.name}, allowed ${peer.allowed_addresses.join(", ")}`]
-      });
-    }
-    if (!clients.length)
-      continue;
-    const outside = graph.node(`clients:${device.name}:${name}`, "outside", `${clients.length} ${clients.length === 1 ? "client" : "clients"}`, clients.map((peer) => `${peer.name}: ${peer.allowed_addresses.join(", ")}`));
-    graph.edge({
-      layer: "tunnels",
-      from: deviceId(device.name),
-      to: outside,
-      label: `WireGuard ${name}`,
-      detail: [`peers that dial in to ${device.name} ${name}`]
-    });
-  }
-}
-function graphOf(devices) {
-  const graph = new Builder;
-  for (const device of devices)
-    graph.node(deviceId(device.name), "device", device.name, describeDevice(device));
-  const holders2 = holdersOf(devices);
-  const owners = new Map;
-  for (const holder of holders2) {
-    const key = keyOf(host(holder.address));
-    if (!owners.has(key))
-      owners.set(key, holder);
+    if (end.iface.vni !== mirror.iface.vni)
+      report(`VNI ${end.iface.vni}, and ${far.name} ${mirror.name} has ${mirror.iface.vni}`);
+    const port = end.iface.port ?? 4789;
+    const farPort = mirror.iface.port ?? 4789;
+    if (port !== farPort)
+      report(`UDP port ${port}, and ${far.name} ${mirror.name} has ${farPort}`);
   }
-  cables(devices, graph);
-  segments(holders2, owners, graph);
-  sessions(devices, owners, graph);
-  adjacencies(devices, graph);
-  tunnels2(devices, owners, graph);
-  return { nodes: [...graph.nodes.values()], edges: graph.edges };
-}
-function only(graph, layers, deviceNames = []) {
-  const named = new Set(deviceNames.map(deviceId));
-  const touches = (edge) => !named.size || named.has(edge.from) || named.has(edge.to);
-  const edges = graph.edges.filter((edge) => layers.includes(edge.layer) && touches(edge));
-  const ends = new Set(edges.flatMap((edge) => [edge.from, edge.to]));
-  const nodes = graph.nodes.filter((node) => (named.size ? named.has(node.id) : node.kind === "device") || ends.has(node.id));
-  return { nodes, edges };
+  return findings;
 }
 
 // src/core/validate.ts
-import { X509Certificate as X509Certificate2 } from "node:crypto";
 function validate(network2) {
   const findings = [];
   const seen = new Set;
@@ -4002,7 +3870,7 @@ function validate(network2) {
       for (const field of adapter.unsupported(device))
         report(`${device.platform} cannot express ${field}`);
   }
-  findings.push(...checkLinks(network2.devices));
+  findings.push(...checkAcross(network2.devices));
   for (const check of network2.checks ?? [])
     findings.push(...check(network2.devices));
   return findings;
@@ -4047,7 +3915,7 @@ function checkDevice(device, report) {
   if (!device.users?.[device.connection.user])
     report(`connection user '${device.connection.user}' is not one of its users`);
   checkVlans(device, report);
-  checkAddresses(device, report, cidr, ip);
+  checkAddresses2(device, report, cidr, ip);
   checkPorts(device, names, report);
   checkInterfaces(device, names, report, ip);
   checkRouting(device, names, report, cidr, ip);
@@ -4066,7 +3934,7 @@ function checkVlans(device, report) {
     ids.set(vlan.id, name);
   }
 }
-function checkAddresses(device, report, cidr, ip) {
+function checkAddresses2(device, report, cidr, ip) {
   const holderOf = new Map;
   const holders2 = [
     ...Object.entries(device.ports ?? {}).map(([name, settings]) => ({ where: `port ${name}`, settings })),
@@ -4279,48 +4147,6 @@ function checkCertificates(device, names, report) {
     }
   }
 }
-function carried(device, port) {
-  const id = (vlan) => vlan ? device.vlans?.[vlan]?.id : undefined;
-  return {
-    access: id(port.access_vlan),
-    native: id(port.native_vlan),
-    trunk: (port.trunk_vlans ?? []).map(id).sort((a, b) => (a ?? 0) - (b ?? 0))
-  };
-}
-function checkLinks(devices) {
-  const findings = [];
-  const byName = new Map(devices.map((device) => [device.name, device]));
-  for (const device of devices) {
-    for (const [portName, port] of Object.entries(device.ports ?? {})) {
-      const link = port?.link;
-      if (!port || !link)
-        continue;
-      const report = (message) => findings.push({
-        level: "error",
-        device: device.name,
-        message: `port ${portName} link: ${message}`
-      });
-      const far = byName.get(link.device);
-      if (!far) {
-        report(`device ${link.device} is not in the network`);
-        continue;
-      }
-      const farPort = far.ports?.[link.port];
-      if (!farPort) {
-        report(`${link.device} does not declare port ${link.port}`);
-        continue;
-      }
-      const linksBack = farPort.link?.device === device.name && farPort.link.port === portName;
-      if (!linksBack)
-        report(`${link.device} ${link.port} does not link back to it`);
-      const here = JSON.stringify(carried(device, port));
-      const there = JSON.stringify(carried(far, farPort));
-      if (here !== there)
-        report(`carries ${here}, and ${link.device} ${link.port} carries ${there}`);
-    }
-  }
-  return findings;
-}
 
 // src/cli/graph.ts
 function markOf(graph, node) {
@@ -4392,6 +4218,117 @@ ${node.detail[0] ?? ""}` : node.label;
 `;
 }
 
+// src/cli/rename.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3, renameSync, writeFileSync } from "node:fs";
+import { basename, dirname, extname, join as join3, resolve as resolve2 } from "node:path";
+
+// src/core/files.ts
+import { readdirSync, readFileSync as readFileSync2 } from "node:fs";
+import { join as join2, relative } from "node:path";
+var SKIPPED = new Set(["node_modules", ".git", ".circuit", "dist"]);
+function projectSources(root2, directory = root2) {
+  const entries2 = readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  return entries2.flatMap((entry) => {
+    if (entry.isDirectory())
+      return SKIPPED.has(entry.name) ? [] : projectSources(root2, join2(directory, entry.name));
+    return /\.(ts|mts|cts)$/.test(entry.name) ? [relative(root2, join2(directory, entry.name))] : [];
+  });
+}
+var escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function declaresDevice(text, name) {
+  const declares = new RegExp(`\\bname\\s*:\\s*(["'\`])${escape(name)}\\1`);
+  return text.includes("defineDevice") && declares.test(text);
+}
+function deviceFiles(root2, name, sources = projectSources(root2)) {
+  return sources.filter((file) => declaresDevice(readFileSync2(join2(root2, file), "utf8"), name));
+}
+
+// src/cli/rename.ts
+var escape2 = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function planRename(root2, from, to, options) {
+  const changes2 = [];
+  const moves = [];
+  const exact = new RegExp(`(["'\`])${escape2(from)}\\1`, "g");
+  const anywhere = new RegExp(`(^|[^A-Za-z0-9_.-])${escape2(from)}(?![A-Za-z0-9_-])`);
+  const sources = projectSources(root2);
+  const declaring = new Set;
+  for (const file of sources) {
+    const text = readFileSync3(join3(root2, file), "utf8");
+    const lines = text.split(`
+`);
+    if (declaresDevice(text, from))
+      declaring.add(file);
+    for (const [index, before] of lines.entries()) {
+      const after = before.replace(exact, (_match, quote3) => `${quote3}${to}${quote3}`);
+      if (after !== before)
+        changes2.push({ file, line: index + 1, before, after });
+    }
+  }
+  if (!declaring.size) {
+    throw new Error(`no file declares name: "${from}"; the name may be built from parts, such as a template string, so rename it by hand`);
+  }
+  for (const snapshot of options.snapshots) {
+    moves.push({ from: snapshot, to: join3(dirname(snapshot), `${to}${extname(snapshot)}`) });
+  }
+  if (options.file) {
+    if (declaring.size > 1)
+      throw new Error(`${[...declaring].join(" and ")} both declare name: "${from}"; rename the file by hand`);
+    const [file] = [...declaring];
+    const target = join3(dirname(file), `${to}${extname(file)}`);
+    if (existsSync2(join3(root2, target)))
+      throw new Error(`${target} already exists`);
+    moves.push({ from: file, to: target });
+    changes2.push(...importChanges(root2, sources, file, target, changes2));
+  }
+  const mentions = sources.flatMap((file) => readFileSync3(join3(root2, file), "utf8").split(`
+`).flatMap((original, index) => {
+    const text = changes2.find((change) => change.file === file && change.line === index + 1)?.after ?? original;
+    return anywhere.test(text) ? [{ file, line: index + 1, text: text.trim() }] : [];
+  }));
+  return { changes: changes2, moves, mentions };
+}
+function importChanges(root2, sources, file, target, earlier) {
+  const result = [];
+  const withoutExtension = (path) => path.replace(/\.(ts|mts|cts|js|mjs|cjs)$/, "");
+  const moved = withoutExtension(resolve2(root2, file));
+  for (const source of sources) {
+    const lines = readFileSync3(join3(root2, source), "utf8").split(`
+`);
+    for (const [index, original] of lines.entries()) {
+      const line2 = index + 1;
+      const changed = earlier.find((change) => change.file === source && change.line === line2);
+      const before = changed?.after ?? original;
+      const after = before.replace(/(\bfrom\s+|\bimport\s*\(\s*)(["'])(\.{1,2}\/[^"']+)\2/g, (match, lead, quote3, specifier) => {
+        if (withoutExtension(resolve2(root2, dirname(source), specifier)) !== moved)
+          return match;
+        const extension = specifier.match(/\.(ts|mts|cts|js|mjs|cjs)$/)?.[0] ?? "";
+        const renamed = `${dirname(specifier)}/${basename(withoutExtension(target))}${extension}`;
+        return `${lead}${quote3}${renamed}${quote3}`;
+      });
+      if (after === before)
+        continue;
+      if (changed)
+        changed.after = after;
+      else
+        result.push({ file: source, line: line2, before: original, after });
+    }
+  }
+  return result;
+}
+function applyRename(root2, plan4) {
+  const files = new Set(plan4.changes.map((change) => change.file));
+  for (const file of files) {
+    const lines = readFileSync3(join3(root2, file), "utf8").split(`
+`);
+    for (const change of plan4.changes.filter((each) => each.file === file))
+      lines[change.line - 1] = change.after;
+    writeFileSync(join3(root2, file), lines.join(`
+`));
+  }
+  for (const move of plan4.moves)
+    renameSync(join3(root2, move.from), join3(root2, move.to));
+}
+
 // src/cli/index.ts
 var HELP = `usage: circuit <command> [device...] [options]
 
@@ -4412,12 +4349,22 @@ var HELP = `usage: circuit <command> [device...] [options]
   prometheus            every device with SNMP, as Prometheus targets for snmp_exporter
                           --auths        snmp_exporter's auths for them instead, with secrets as \${NAME}
   secrets               every secret the config uses, and whether each can be read
+  rename <device> <new-name>
+                        give a device a new name in every file that names it, with --confirm
+                          --file         also rename the file that declares it, to <new-name>.ts
+  addresses [prefix]    every address the config uses, by prefix, and what is still free
+                          --length=N     free prefixes of this length, instead of the fewest that cover the free space
+                          --format=json  as JSON
   graph [device...]     the network as a graph, from the config alone, without contacting a device
                           --layer=l1     l1, l2, l3, bgp, ospf or tunnels, several with commas, or all
                           --format=mermaid  mermaid, dot or json
-  studio                the graph in the browser, drawn again whenever the config changes
-                          --port=4600    the port it listens on, on this machine only
+  studio                Circuit Studio: the network in the browser, drawn again whenever the config changes
+                          --port=4600    the port it listens on
                           --no-open      do not open the browser
+                          --host=0.0.0.0 listen on a server's address instead, with --allow-host
+                          --allow-host=studio.example.com
+                                         the names it is reached by, several with commas
+                          --json         print what Studio shows, as JSON, instead
 
   --config <path>       the network's config file, circuit.config.ts in the working directory by default`;
 var DEFAULT_CONFIG = "circuit.config.ts";
@@ -4434,12 +4381,12 @@ if (!command2 || command2 === "help" || command2 === "--help" || command2 === "-
 var configAt = args.indexOf("--config");
 var configArgument = configAt >= 0 ? args[configAt + 1] : args.find((arg) => arg.startsWith("--config="))?.slice("--config=".length);
 var rest = args.filter((arg, index) => index !== configAt && (configAt < 0 || index !== configAt + 1) && !arg.startsWith("--config="));
-var configPath = resolve2(process.cwd(), configArgument ?? DEFAULT_CONFIG);
-if (!existsSync2(configPath)) {
+var configPath = resolve3(process.cwd(), configArgument ?? DEFAULT_CONFIG);
+if (!existsSync3(configPath)) {
   console.error(configArgument ? `no config at ${configPath}` : `no ${DEFAULT_CONFIG} in ${process.cwd()}; name another with --config <path>`);
   process.exit(1);
 }
-var root2 = dirname(configPath);
+var root2 = dirname2(configPath);
 useRoot(root2);
 async function load(path) {
   if (process.versions.bun)
@@ -4471,9 +4418,9 @@ function one() {
   return device ?? fail("name a device");
 }
 var adapterOf = (device) => adapters[device.platform] ?? fail(`no adapter for ${device.platform}`);
-var generated = join2(root2, ".circuit");
-var stateDirectory = join2(generated, "state");
-var statePath = (device) => join2(stateDirectory, device.name + adapterOf(device).extension);
+var generated = join4(root2, ".circuit");
+var stateDirectory = join4(generated, "state");
+var statePath = (device) => join4(stateDirectory, device.name + adapterOf(device).extension);
 var GENERATED_README = `# Written by Circuit
 
 Do not edit anything here: an edit changes nothing on a device, and Circuit overwrites it. Change the config instead.
@@ -4482,8 +4429,8 @@ Do not edit anything here: an edit changes nothing on a device, and Circuit over
 `;
 function writeState(device, text) {
   mkdirSync(stateDirectory, { recursive: true });
-  writeFileSync(join2(generated, "README.md"), GENERATED_README);
-  writeFileSync(statePath(device), text);
+  writeFileSync2(join4(generated, "README.md"), GENERATED_README);
+  writeFileSync2(statePath(device), text);
 }
 function guard(devices) {
   const relevant = new Set(devices.map((device) => device.name));
@@ -4525,12 +4472,12 @@ function diffCommand() {
   let differences = 0;
   for (const device of devices) {
     const path = statePath(device);
-    if (!existsSync2(path)) {
+    if (!existsSync3(path)) {
       console.log(`${device.name}: no snapshot, run snapshot first`);
       continue;
     }
     const adapter = adapterOf(device);
-    const plan4 = adapter.plan(adapter.render(device), readFileSync2(path, "utf8"), options);
+    const plan4 = adapter.plan(adapter.render(device), readFileSync4(path, "utf8"), options);
     differences += show(device, plan4);
   }
   process.exit(differences ? 1 : 0);
@@ -4542,13 +4489,13 @@ async function snapshotCommand() {
     console.log(`${device.name}: ${text.split(`
 `).length} lines`);
   }
-  if (names.length || !existsSync2(stateDirectory))
+  if (names.length || !existsSync3(stateDirectory))
     return;
-  const current = new Set(network2.devices.map((device) => basename(statePath(device))));
-  for (const file of readdirSync(stateDirectory)) {
+  const current = new Set(network2.devices.map((device) => basename2(statePath(device))));
+  for (const file of readdirSync2(stateDirectory)) {
     if (current.has(file))
       continue;
-    rmSync(join2(stateDirectory, file));
+    rmSync(join4(stateDirectory, file));
     console.log(`${file}: removed, no such device in the config`);
   }
 }
@@ -4714,11 +4661,11 @@ ${references.length} secret(s), ${missing} missing.`);
 var flagValue = (name) => flags.find((flag) => flag.startsWith(`--${name}=`))?.slice(name.length + 3);
 function driftOf(device) {
   const path = statePath(device);
-  if (!existsSync2(path))
+  if (!existsSync3(path))
     return { status: "no snapshot", lines: [] };
   try {
     const adapter = adapterOf(device);
-    const plan4 = adapter.plan(adapter.render(device), readFileSync2(path, "utf8"), options);
+    const plan4 = adapter.plan(adapter.render(device), readFileSync4(path, "utf8"), options);
     const lines = [
       ...plan4.steps.flatMap((step) => [step.title, ...step.show.map((line2) => `  ${line2}`)]),
       ...plan4.problems.map((problem) => `PROBLEM ${problem}`)
@@ -4728,6 +4675,15 @@ function driftOf(device) {
     return { status: "cannot plan", lines: [error.message] };
   }
 }
+function annotatedGraph(layers, deviceNames) {
+  const graph = only(graphOf(network2.devices), layers, deviceNames);
+  const shown = new Set(graph.nodes.map((node) => node.label));
+  return {
+    ...graph,
+    findings: validate(network2).filter((finding) => !finding.device || shown.has(finding.device)),
+    drift: Object.fromEntries(network2.devices.filter((device) => shown.has(device.name)).map((device) => [device.name, driftOf(device)]))
+  };
+}
 function graphCommand() {
   const requested = (flagValue("layer") ?? "l1").split(",");
   const layers = requested.includes("all") ? [...LAYERS] : requested;
@@ -4736,13 +4692,7 @@ function graphCommand() {
     fail(`no layer ${unknown.join(", ")}; known: ${LAYERS.join(", ")}, all`);
   const format = flagValue("format") ?? "mermaid";
   const devices = selected(true);
-  const graph = only(graphOf(network2.devices), layers, names.length ? devices.map((device) => device.name) : []);
-  const shown = new Set(graph.nodes.map((node) => node.label));
-  const annotated = {
-    ...graph,
-    findings: validate(network2).filter((finding) => !finding.device || shown.has(finding.device)),
-    drift: Object.fromEntries(network2.devices.filter((device) => shown.has(device.name)).map((device) => [device.name, driftOf(device)]))
-  };
+  const annotated = annotatedGraph(layers, names.length ? devices.map((device) => device.name) : []);
   if (format === "mermaid")
     process.stdout.write(mermaid(annotated));
   else if (format === "dot")
@@ -4752,12 +4702,117 @@ function graphCommand() {
   else
     fail(`no format ${format}; known: mermaid, dot, json`);
 }
+function printSegment(segment, indent) {
+  const next = segment.next ? `, next ${segment.next}` : "";
+  console.log(`${indent}${segment.prefix}, ${segment.free} free${next}`);
+  const width = Math.max(...segment.uses.map((use) => use.address.length)) + 2;
+  for (const use of segment.uses)
+    console.log(`${indent}    ${use.address.padEnd(width)}${use.what}`);
+}
+function addressesCommand() {
+  const [within] = names;
+  if (within && !isCidr(within))
+    fail(`${within} is not a prefix, such as 10.0.0.0/16`);
+  const lengthText = flagValue("length");
+  const length = lengthText === undefined ? undefined : Number(lengthText);
+  if (length !== undefined && !(Number.isInteger(length) && length >= 0 && length <= 128))
+    fail("--length takes a prefix length, such as 24");
+  const report = addressesOf(network2.devices, within);
+  if (flagValue("format") === "json") {
+    console.log(JSON.stringify(report, null, 4));
+    return;
+  }
+  for (const space of report.spaces) {
+    console.log(`${space.prefix}, ${space.owner}`);
+    for (const segment of space.segments)
+      printSegment(segment, "  ");
+    for (const block of space.blocks)
+      console.log(`  ${block.prefix}  ${block.what}`);
+    if (length === undefined) {
+      console.log(`  free: ${space.free.join(", ") || "none"}`);
+    } else {
+      const { prefixes, total } = freeOfLength(space.free, length, 16);
+      const more = total > BigInt(prefixes.length) ? `, and ${total - BigInt(prefixes.length)} more` : "";
+      console.log(`  free /${length}: ${prefixes.join(", ") || "none"}${more}`);
+    }
+    console.log("");
+  }
+  const { segments, blocks } = report.elsewhere;
+  if (segments.length || blocks.length) {
+    console.log("Outside the space the network originates");
+    for (const segment of segments)
+      printSegment(segment, "  ");
+    for (const block of blocks)
+      console.log(`  ${block.prefix}  ${block.what}`);
+  }
+  if (!report.spaces.length && !segments.length && !blocks.length)
+    console.log("The config holds no addresses.");
+}
+function renameCommand() {
+  const [from, to] = names;
+  if (!from || !to)
+    fail("usage: circuit rename <device> <new-name> [--file] [--confirm]");
+  const device = network2.devices.find((candidate) => candidate.name === from);
+  if (!device)
+    fail(`no device ${from}; known: ${network2.devices.map((candidate) => candidate.name).join(", ")}`);
+  if (network2.devices.some((candidate) => candidate.name === to))
+    fail(`${to} is already a device`);
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(to))
+    fail(`${to} is not a hostname: letters, digits, dots, dashes and underscores`);
+  const snapshot = statePath(device);
+  const snapshots = existsSync3(snapshot) ? [relative2(root2, snapshot)] : [];
+  let plan4;
+  try {
+    plan4 = planRename(root2, from, to, { file: flags.includes("--file"), snapshots });
+  } catch (error) {
+    fail(error.message);
+  }
+  for (const change of plan4.changes) {
+    console.log(`${change.file}:${change.line}`);
+    console.log(`  - ${change.before.trim()}`);
+    console.log(`  + ${change.after.trim()}`);
+  }
+  for (const move of plan4.moves)
+    console.log(`move ${move.from} to ${move.to}`);
+  if (plan4.mentions.length) {
+    console.log(`
+Still naming ${from}, left as they are: change them by hand if they mean the device.`);
+    for (const mention of plan4.mentions)
+      console.log(`  ${mention.file}:${mention.line}  ${mention.text.slice(0, 160)}`);
+  }
+  if (!confirmed) {
+    console.log(`
+Nothing written. Re-run with --confirm.`);
+    return;
+  }
+  applyRename(root2, plan4);
+  console.log(`
+Renamed. Run circuit validate, then circuit apply ${to}: the device keeps its old hostname until then.`);
+}
 async function studioCommand() {
+  if (flags.includes("--json")) {
+    const sources = projectSources(root2);
+    const data = studioData(network2.devices, annotatedGraph(LAYERS, []), {
+      render: (device) => adapterOf(device).render(device),
+      snapshot: (device) => existsSync3(statePath(device)) ? readFileSync4(statePath(device), "utf8") : undefined,
+      files: (device) => ({
+        source: deviceFiles(root2, device.name, sources)[0]?.split(sep).join("/"),
+        snapshot: existsSync3(statePath(device)) ? relative2(root2, statePath(device)).split(sep).join("/") : undefined
+      })
+    });
+    console.log(JSON.stringify(data));
+    return;
+  }
   const port = Number(flagValue("port") ?? 4600);
   if (!Number.isInteger(port) || port < 1 || port > 65535)
     fail("--port takes a number from 1 to 65535");
-  const { studio } = await import("../chunks/studio-femhydvd.js");
-  await studio({ configPath, root: root2, port, open: !flags.includes("--no-open") });
+  const { isLoopback, studio } = await import("../chunks/server-5shmsmse.js");
+  const host2 = flagValue("host") ?? "127.0.0.1";
+  const allowHosts = (flagValue("allow-host") ?? "").split(",").filter(Boolean);
+  if (!isLoopback(host2) && !allowHosts.length) {
+    fail(`Studio on ${host2} needs --allow-host=<name>, the name people reach it by, such as studio.example.com`);
+  }
+  await studio({ configPath, root: root2, port, open: !flags.includes("--no-open"), host: host2, allowHosts });
 }
 var commands = {
   validate: validateCommand,
@@ -4772,6 +4827,8 @@ var commands = {
   librenms: librenmsCommand,
   prometheus: prometheusCommand,
   secrets: secretsCommand,
+  rename: renameCommand,
+  addresses: addressesCommand,
   graph: graphCommand,
   studio: studioCommand
 };